A draft law n°7184 establishing the National Commission for Data Protection and implementing the General Data Protection Regulation (GDPR) was published on September 12, 2017 (the “Draft Law”).
Proposals for amendments by the group of government delegates have been made on March 8, 2018 a.o. with a view to addressing data protection issues in connection with the supervision of employees at the workplace. These amendments are made in the context of Article 88 of the GDPR allowing Member State to provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees’ personal data in the employment context.
The matter is governed by Article L.261-1 of the Labour code, currently providing that in order to implement a supervision system at the workplace, a prior authorisation by the Commission Nationale pour la Protection des Données (CNPD) will be required.
The CNPD verifies if all legal requirements are satisfied, a.o. whether the processing is legitimate and if the monitoring in the workplace is proportionate to the purpose that is pursued by the employer.
According to Article L. 261-1 of the Labour Code, such processing is only lawful if it is required to :
The Joint Works Council (to be replaced by the staff delegation after the next social elections) has a co-decision right in the event of implementation of supervision measures foreseen under points 1, 4 and 5.
Notwithstanding the right to information to the concerned employees as provided for by general data protection legal provisions, the employer must comply with a prior information requirement to :
The draft law provides that the supervision at the workplace may be implemented in compliance with the GDPR by the employer as a controller.
The draft law introduces a twofold regime depending on the grounds that render the processing lawful and whether such ground of lawfulness is subject to a co-decision requirement:
(a) If such processing is based on the requirement to:
the following conditions will apply:
(b) If the processing is based on any other grounds for lawfulness as provided for by Article 6 of the GDPR, the staff delegation, as the case may be, or, the concerned employees, may apply for a preliminary opinion with the CNPD as to the compliance of the contemplated supervision measures. The CNPD must issue an advice within one month. Such request will have suspensive effects.